Skip to main content
Docs

Search documentation

0 articles

    Contents

    Check build and run access separately

    Hosted generation and hosted invocation are independently controlled capabilities. Being able to edit a plan or inspect a version does not prove that either cloud operation is enabled.

    Read the account boundary​

    Use the signed-in account read, GET /hvy/v1/account, and examine services. services["cloud.loops.build"] === true permits the hosted build path; services["cloud.loops.run"] === true is the separate run capability. Read the actual boolean value rather than treating a successful sign-in as entitlement.

    The account comes from the authenticated session. Do not supply someone else's account ID or transfer credentials between browser, native and terminal session authorities. A false capability is not repaired by calling an alternate undocumented route.

    Match permission to the action​

    Writing or retaining a local draft is not a hosted build. Generating a candidate needs build access and consent to process the brief. Invoking an approved artifact needs run access, explicit inputs and invocation consent. An approved version can exist while run access is unavailable.

    A governed runtime connection has its own identity, catalogue and policy checks. Its source interface is not evidence that a hosted account flag enabled that separate execution track.

    Check without starting work​

    Read the flags and retain only the non-secret result. Do not start a paid run to test whether a permission is present. If access is false or refused, keep the plan unexecuted and review shared account guidance.

    For subscription or frozen-account refusals, inspect the actual account state rather than changing keys, permissions or plans as a troubleshooting shortcut. See cloud consent for the separate authorization fields.

    MDN: HTTP 202 Accepted explains why request acceptance is not completion. Use the owning Loop run record to establish the actual execution state.